Is their password change function working? I can't seem to change my pw. It gets to SMS 2FA then appears to fail when I try to verify the token I'm sent and boots me back to the PW change page.
DoorDash confirms data breach affected 4.9M customers, workers and merchants
211–220 of 224 posts
Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants
#212Earlier quoted context omitted.
Basically if you "tip" a driver through DoorDash, the tip doesn't really end up going to them. https://qz.com/1659475/the-merits-of-tipping-your-doordash-d...
DoorDash implemented that scheme to give more consistent payments to workers, as tips are quite variable. Anyway, if it helps, DoorDash is currently moving away from that model. [0] [0] https://www.theverge.com/2019/8/22/20828742/doordash-tipping...
> as tips are quite variable
That's kind of the point. And par for the course in any tipped job.
If DoorDash had actually wanted to make it consistent, they would've just removed tipping, like everyone else does that wants to do that.
What they did was shady as hell, and they know it which is why they are changing it.
---
* There is the common, legally mandated practice for employees where minimum wage is paid instead of tips, until base pay plus tips meets that. You could make the argument that DoorDash base pay is simply $0.
But (A) base pay of $0 is never done (B) base plus tips don't typical fall below minimum wage (C) this doesn't really apply anyway since DoorDash doesn't pay wages; it pays contractor fees.
Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants
#213I'd like to point out, it's not "DoorDash" that has done anything wrong, it's these people : - Andy Fang - Evan Moore - Stanley Tang - Tony Xu They decided our security and privacy wasn't worth as much as hur hur hur growth hacking startup hur hur next uber, and couldn't be arsed to even give us a proper apology. Look at their blog post: not one mention of the words "we sorry, we fucked up". It's all about the other…
Is there something about this story that makes you think it's an issue of negligence rather than a capable intruder? We keep getting told that total security is impossible. Isn't this inevitable? Is it just that they waited too long to disclose it?
Security is a cost/benefit decision, not a binary one. More security costs more. Putting the drivers licenses and bank details of employees in the same database as the credit cards and names of customers is cheaper than putting them on separate databases. Putting them on the Internet is cheaper than having a separate network. Turning off your logs "when you don't need them" is cheaper than leaving them on all the time.
If anyone says "total security is impossible" you just say: So fucking what? That's not an excuse for spending as little on security as possible, and you know someone isn't serious about security if they avoid admitting they are responsible for the security in the first place.
Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants
#214Earlier quoted context omitted.
I think I take the credit monitoring in this instance?
I'll throw it on the pile of all the other credit monitoring I've gotten from other breaches.
Sadly credit monitoring just increases the chance that your data will be breached once again - what about the option where, because you guys done goofed with my data, you're not allowed to track me anymore or store any data on me - and you're not allowed to charge me to do this nor randomly charge me if a bank tries to talk to you.
Credit Bureaus are just such steaming piles of crap.
Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants
#215Earlier quoted context omitted.
Did they make that clear to the end customer that this is what's happening with the tips? I don't care what their contract with the delivery driver states, if they allow me to add a tip I expect that tip to go in the driver's pocket in addition to whatever they'd get paid without the tip, just like if I was giving them cash directly. If that's not what's happening they have essentially defrauded me and I wouldn't be…
When was the last time a restaurant disclosed this arrangement to you?
Restaurants are bound by labor laws that require minimum wages to be paid to employees. As far as I know, Doordash drivers are not employees but are independent contractors which means they aren't required to be paid minimum wage under the Fair Labor Standards Act. Since they aren't required to be paid minimum wage this situation is completely different than at a restaurant
Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants
#216Earlier quoted context omitted.
> Also, when you dispute a charge, they are able to put the money in 'escrow', basically, while they investigate... since they control both sides of the transaction (both merchant and customer), they 'keep' the money while they resolve it. If they find in the card user's favor, they deduct it from the merchant account and credit it back to the card user. Otherwise, they release the hold and the merchant can withdraw…
I mean, they can't really 'invest it' since it was their money in the first place. They are loaning it to the credit card holder, who is giving it to the merchant. In this case they just don't loan it out until the case is resolved.
> I mean, they can't really 'invest it' since it was their money in the first place.
By extending someone a line of credit, they are investing some percentage of that line of credit as their money, because they have to have money on hand in case the person decides to use their credit card. They obviously don't have to keep the whole balance of every line of credit they extend on hand, because most people won't max out all their lines of credit. But they do have to keep some percentage. That money is invested, but only pays out money if the person uses their credit card and then rolls over a balance to accrue interest.
But let's say someone uses a credit card, and then someone disputes the charge (these are different people if the charge was fraudulent). The credit card company holds that money in escrow. While it's in escrow, they don't pay it to the merchant, so they still have it, and they don't count it toward their customer's credit limit, so it decreases the amount of money they have to keep on hand. However, they're still charging interest for it in the case that the charge is found to not be fraudulent. So their investment is paying off.
Now where this gets tricky, is now that money is invested, because they're charging interest for it, but they know they won't have to pay out that investment until the fraud investigation completes. So until then, they can invest it again! They always have to keep some money on hand in preparation for a fraud investigation to finish, but there is always some amount of money being tied up in escrow for ongoing fraud investigations, so they can invest that money twice.
Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants
#217I'd like to point out, it's not "DoorDash" that has done anything wrong, it's these people : - Andy Fang - Evan Moore - Stanley Tang - Tony Xu They decided our security and privacy wasn't worth as much as hur hur hur growth hacking startup hur hur next uber, and couldn't be arsed to even give us a proper apology. Look at their blog post: not one mention of the words "we sorry, we fucked up". It's all about the other…
I'm very uncomfortable with this level of personal shaming. There's a reason most serious tech companies have adopted a "blameless post-mortem" culture. When you individually vilify people for mistakes, you create a culture of fear and kill initiative and risk-taking. Maybe you think everything worthwhile has already been invented, but I don't.
Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants
#218I've been vending myself unique email addresses for every online account I use for about 3 years. They are nice because I can reply to them like a regular mail and my actual email account gets stripped out automagically. I've been considering making it a product and I wonder in this case what people would want to do when the account data gets leaked? 1. blackhole all email to the address. 2. forward all email to some…
You can do something similar with fastmail. Get a domain for your email and make an alias address of the form [anything]@[alias].domain.com . You can then make 'sending identities' for an instance of that catchall domain for the rare time you need to send email as mortgage_company@a.domain.com . You can also create rules to blackhole a specific alias email or whatever you want when you need to invalidate the email.
Fastmail also have tons of alternative domains like nospammail.net so you can make your registering emails in a domain that is separate from you email address.
So your address is me@fastmail.com but you could use adresses like mortgage_company@alias.nospammail.net...
Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants
#219I propose a way to improve cybersecurity: FINE companies who loose sensitive customer data to hackers. Fines can be calculated according to the "breach severity grid" which is based on the type of data that is lost. For example: 1. Personal address, DOB - $15. 2. Each social security $20. 3. Driver license number $25. 4. Bank account numbers $30. etc. So a loss of 4.9 million social security numbers, DOB and addresse…
I would add passwords to the list of fines with growing penalties based on how the passwords were stored. Unique salt per user hash < shared salt with user hash < no salt but using strong hash < no salt and a weak algorithm like MD5 or SHA-1 < plaintext
great suggestion! loosing data that is well protected is one things, but loosing plain text personal info is totally different matter and should be punished more.
Re: DoorDash confirms data breach affected 4.9M customers, workers and merchants
#220After using food delivery and takeout services, I felt the plastic waste it generates is incredible. All the folks that care even a little bit about the environment, please just get out of your homes and just dine-in. Silicon Valley startups just don’t care about the environment, you can change that one person at a time.